Re-vendor the shared files from sneak/prompts at dd4027b (closes #113)

The shared files are the sneak/prompts copies at dd4027b, plus this
repository's own entries. make lint and make test each build one
Dockerfile phase without the cache, both covering the frontend; the
builder stage waits on both and takes its version from git describe
unless VERSION is given. The test phase keeps Go's module and build
caches in memory, out of the image make test tags. golangci-lint moves
to v2.14.0 with the new .golangci.yml; one test spells X-Request-ID as
canonicalheader asks. prettier formats only JavaScript, CSS, HTML and
Markdown, so .golangci.yml stays as fetched. script/fmt and
script/fmt-check put ~/.local/bin on PATH. script/bootstrap keeps a Go
only if it is exactly GO_VERSION, and re-checks the go on PATH after
installing.

Model: opus-5-5

Dockerfile

@@ -62,13 +62,17 @@ RUN yarn build
 # ships and the alpine one does not. -timeout 90s is a backstop above
 # the 60-second cap on the suite. The rerun with -v only shows details:
 # the step fails however it ends, because the first run already failed.
+# Go's module and build caches are in memory (tmpfs) for the go test
+# step alone, so the image make test tags does not carry them and the
+# build spends no time writing them into it. They start empty on every
+# build, so no stored test result can stand in for a run.
 # golang:1.25.7-trixie, 2026-10-07
 FROM golang@sha256:2b174ffcf56c7ad0c47d30d2630693265639ddf2a5141149c2da34db921791b4 AS test
 WORKDIR /src
-COPY backend/go.mod backend/go.sum ./
-RUN go mod download
 COPY backend/ .
-RUN go test -timeout 90s -race -cover ./... || \
+RUN --mount=type=tmpfs,target=/go/pkg/mod \
+    --mount=type=tmpfs,target=/root/.cache/go-build \
+    go test -timeout 90s -race -cover ./... || \
     { echo "--- Rerunning with -v for details ---"; \
       go test -timeout 90s -race -v ./...; exit 1; }
 # Nothing is wanted from the frontend stage; the copy is what makes